Overview

overview

7

Static

static

7

94a8f73040...cs.exe

windows7-x64

7

94a8f73040...cs.exe

windows10-2004-x64

7

$LOCALAPPD...ly.exe

windows7-x64

7

$LOCALAPPD...ly.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...dt.dll

windows7-x64

1

$PLUGINSDI...dt.dll

windows10-2004-x64

1

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$_0_/exten...lts.js

windows7-x64

3

$_0_/exten...lts.js

windows10-2004-x64

3

background.html

windows7-x64

1

background.html

windows10-2004-x64

1

DealPlyIE.dll

windows7-x64

6

DealPlyIE.dll

windows10-2004-x64

6

vn-zugo.exe

windows7-x64

7

vn-zugo.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vn-zugo.exe
  • Size 720KB
  • Sample240517-dpbcnseh34
  • SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe
    "C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:1140
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3596

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GetVersion.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\GetVersion.dll
          • Size 6KB
          • SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Math.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\Math.dll
          • Size 66KB
          • SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NSISdl.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\NSISdl.dll
          • Size 14KB
          • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\System.dll
          • Size 11KB
          • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          inetc.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\inetc.dll
          • Size 20KB
          • SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          linker.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\linker.dll
          • Size 6KB
          • SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md5dll.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\md5dll.dll
          • Size 8KB
          • SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
          • MD5 SHA1 SHA512
          Submit Download

          nshist.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\nshist.dll
          • Size 39KB
          • SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tbdata.json
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\tbdata.json
          • Size 1KB
          • SHA256 35a17800abb6ec63c0f04e9121520c560413bb38e1116e9119cdb406dd21757a
          • MD5 SHA1 SHA512
          Submit Download

          timepro.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse32A.tmp\timepro.dll
          • Size 20KB
          • SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1140-19-0x0000000003130000-0x000000000314A000-memory.dmp
          Download

          memory/1140-226-0x0000000004170000-0x0000000004179000-memory.dmp
          Download

          memory/1140-34-0x0000000003150000-0x0000000003159000-memory.dmp
          Download